Malicious Bitwarden CLI Hits npm in Supply Chain Attack

A malicious version of the Bitwarden command-line interface (CLI) was briefly published to the npm package registry on April 22, 2026, exposing developers to credential theft as part of a broader supply chain attack campaign.

The compromised package, bitwarden-cli version 2026.4.0, appeared between 5:57 p.m. and 7:30 p.m. ET, a window of approximately 90 minutes, before Bitwarden detected and removed it. Security researchers from firms including Socket, JFrog, and OX Security identified the issue, attributing it to attackers who exploited a compromised GitHub Action in Bitwarden's continuous integration and continuous delivery (CI/CD) pipeline. This method mirrors tactics used in recent attacks on other open-source projects.

The malicious payload, contained in a file named bw1.js, activated during installation via a preinstall hook. It employed a custom loader, bw_setup.js, to check for and install the Bun runtime if needed, then executed the obfuscated script. The code targeted a wide array of sensitive data, including GitHub and npm tokens, SSH keys, environment variables, shell history, and cloud credentials for AWS, Azure, and Google Cloud. Stolen information was compressed,...